Architecture at a glance
Your workstation — QcHelper app
- Document parsing: PDFs, drawings, specs, manuals — OCR for scanned pages
- Local index: full-text + semantic (vector) search, stored in a local database on the machine
- Construction-tuned retrieval: lower weight for superseded / obsolete / archive folders, document-type and discipline ranking
- Chat UI listing the source files consulted; opens them in your default viewer
TLS
⇄
indexing: document text
answering: questions, excerpts,
file & folder names, page images
answering: questions, excerpts,
file & folder names, page images
VincData AI platform (Canada)
- Private, VincData-operated AI inference servers — no third-party AI providers
- Answer generation grounded in the excerpts provided with each question
- Per-user authentication; trial access enforced server-side (invite-only)
- User accounts hosted in Canada (AWS ca-central-1)
Data flow
What goes where.
| Data | Where it goes | Handling |
|---|---|---|
| Your document files | stays local | Parsed and indexed on the workstation. The files themselves are not uploaded, with one exception: a photo or image file you ask about is sent so the AI can read it. What is sent is listed below. |
| Search index | stays local | Stored in a local database on the workstation. A built-in control deletes all local QcHelper data on demand. |
| Document text | TLS to VincData | During indexing, the text extracted from every document (including OCR text) is sent, chunk by chunk, to compute search embeddings. At question time, the matching excerpts accompany your question so the AI can answer from them. |
| File and folder names | TLS to VincData | Each excerpt is labelled with its file name and its folder path within the project (not the full path on your disk). Questions that list or count documents also send file names and project folder names. |
| Page images & photos | TLS to VincData | For questions about what is on a page (a drawing, table, diagram or scan), up to four rendered page images are sent. For questions about a photo, the image file itself is sent. No images are sent during indexing; OCR runs locally. |
| Your questions | TLS to VincData | Sent with recent conversation (earlier questions and answers) and the matching excerpts to generate the answer. Answers stream back over the same encrypted channel. |
| Third-party AI providers | never | No OpenAI, no public AI clouds. Inference runs on VincData’s own servers in Canada. |
Security posture
What’s in place today.
Invite-only access, enforced server-side. API access requires an active trial authorization; unauthorized tokens are rejected and denials are logged.
Per-user authentication. Individual sign-in for every user; sessions can be remembered per device or kept ephemeral.
Encrypted in transit. All app-to-server traffic uses TLS.
Confidentiality paperwork ready. Pilot participation requires a signed agreement covering confidentiality and data handling.
Local data control. Delete-all-local-data is built into the app’s settings.
Signed updates. Updates install automatically over an encrypted connection and are cryptographically verified before they install.
Security checklist
Straight answers — including the “not yet” ones.
This is what is actually in place today, stated plainly. Ask for the latest version before a procurement review.
| Item | Status today (beta) |
|---|---|
| Authentication | Invite-only email + password accounts (no self-registration); per-user, server-side access control on every AI endpoint. |
| MFA / SSO (SAML) | Not currently offered. Tell us what your organization needs — the beta roadmap is shaped with pilot participants. |
| RBAC / roles | Single-user desktop app — access is a per-user server-side allow-list; no role tiers to manage. |
| Audit logging | Every AI request is authenticated and logged server-side (account, endpoint, timestamp); access denials logged with the account and endpoint involved. |
| Encryption in transit | TLS 1.2/1.3 on all app-to-server traffic. |
| Encryption at rest | Index lives in your Windows profile and inherits your machine’s protections (e.g. BitLocker); no separate app-level encryption. Our servers store no document content at rest. |
| Data retention | Questions and excerpts are processed in memory, not stored as content; server logs keep request metadata only (account, timestamps, token counts). |
| Updates | Delivered automatically in-app over an encrypted connection. Update packages are signed with VincData’s own key and verified by the app before they install (this is separate from Windows installer signing, below). |
| Installer signing | The Windows installer is not yet Authenticode code-signed, which is why SmartScreen may warn on first install. Code signing is implemented in the build and waiting on the certificate authority’s identity verification. |
| Incident notification | The pilot agreement includes a contractual data-incident notification commitment that extends to our subprocessors. |
| Compliance certifications | None yet (SOC 2 / ISO 27001 not claimed) — this page states what is actually in place today; ask for the latest version before procurement review. |
| Subprocessors | Cloudflare sits in front of VincData’s AI servers: traffic is encrypted from the app to Cloudflare, which decrypts each request at its edge and re-encrypts it to our servers. Cloudflare acts as our service provider under its data-processing terms. Supabase / AWS ca-central-1 holds user account records only. No other party receives your questions or document excerpts. |
| Availability / SLA | No formal SLA during the beta — best-effort support directly from the developer. |
| Penetration testing | No independent pen test yet; an internal security-hardening program is in place and documented. |
| If VincData disappears | Your document files stay on your machine and are never modified; the index is a local file you can wipe with Delete All Data. Whatever happens to us, your documents are still on your machine, where they always were. |
Capabilities & requirements
What it reads, where it runs.
| Document types | PDF (incl. scanned pages via OCR), Word, Excel, PowerPoint, CSV and text files; revisions read from file names, or from a revision marker near the start of the document’s text; title blocks are not parsed as such and revision status is not verified. Reads any folder or mapped network share — incl. exports from SharePoint, Procore or Aconex. |
| Search & answers | Hybrid keyword + semantic search; plain-English answers listing the source files consulted (up to four), each opening in one click; documents in superseded / obsolete / archive / old folders given lower weight (revision status is not verified — check the cited source); designed not to fill gaps with guesses. |
| Connectivity | An internet connection is required to sign in, start the app (signed version check) and index; AI answers need one too. If the connection drops mid-session, viewing already-indexed documents keeps working. |
| System | Windows 10/11 (64-bit); standard Windows installer (admin rights); no server components on your network; invite-only VincData account required. |
| Cost to try | Free of charge during the private beta — no payment details are ever collected. Support comes directly from the developer. Commercial pricing will be announced after the beta. |
790 of 790 citations pointed to a real document in the index — no fabricated sources found · 10/10 honesty traps passed · 3,000+ automated tests (internal, June 2026). How the citations were checked →
Technical questions? Ask the builder directly.
Architecture, security review, pilot terms — a direct line to the developer